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REMARKS 

Claims 45-49 are added. Accordingly claims 1-49 are all the claims pending in 
the application. 

Regarding preliminary matters, the Office Action mailed October 31, 2002, did 
not include a Notice of References (PTO-892), although attachment of such a document 
was indicated in the Office Action Summary. Applicant respectfully requests that the 
Examiner include a copy of the Notice of References in the next Office paper. 

Claims 1-44 stand rejected under 35 U.S.C. §103(a) as being unpatentable over 
Heath et al. ("Heath") in view of Schneider et al. ("Schneider"). Applicant respectfully 
traverses the rejection at least because the asserted combination does not include all the 
limitations recited in the claims, hi particular, neither reference, alone or in combination 
discloses using an access vector to identify an available access object. 

Claims 1, 1 1, and 21, are directed to methods, apparatuses, and articles of 
manufacture, respectively, for determining access to a system. These claims recite, for 
each of a plurality of requests, determining whether to allow access to the system using 
an access vector to identify an available access object. 

Heath is relied on for receiving one or more requests to access a system, but the 
Examiner admits that Heath fails to teach, for each request, determining whether to allow 
access to the system using an access vector to identify an available access object. 
Schneider is relied upon to fulfill that deficiency. That is, Schneider is relied upon for 
teaching an access vector that is used to identify an available access object. The 
Examiner asserts that it would have been obvious to combine the teachings of Heath with 
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Schneider for the purpose of overcoming the scalability problems of the prior art access 
filters presented for virtual private networks. 

Even assuming arguendo that it would have been obvious to combine the 
teachings of Heath and Schneider, as asserted in the Office Action, which it is 
respectfully submitted that it would not have been, such a combination does not satisfy 
all the limitations of claim 1. This is because the combination does not teach or suggest 
determining whether to "allow access to the system using an access vector to identify an 
available access object" as required by the claims. 

Heath discloses granting a connection to a client by using conventional 
usemame/password authentication and validating requests for access to an application 
program based upon a subscriber privilege level associated with the cUent. 

Schneider discloses a scalable access filter for use in a virtual private network in 
which individual access filters use local copies of an access control database, shown in 
Fig. 3, to make local access control decisions. The access control database contains 
access policy, administrative policy, and policy-maker policy information that includes a 
sensitivity level associated with each information resource for which the access filter 
controls access. However, nowhere does Schneider disclose or even suggest using an 
access vector to identify an available access object. Figure 3, for example, depicts an 
access control database using a complex system-level block diagram, but nowhere does 
that diagram depict a vector. Similarly, in Figure 15, Schneider discloses a complex 
database schema to depict a portion of the access control database that contains 
information about resources at each site. However, nowhere in that figure does 
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Schneider teach or even suggest use of a vector, much less, an access vector to identify an 
available access object. 

Schneider does not disclose a vector, and accordingly, it is respectfully submitted 
that Schneider does not teach or suggest determining whether to allow access to a system 
using an access vector to identify an available access object. Even when considered with 
Heath, the Heath/Schneider combination does not teach or suggest determining whether 
to allow access to a system using an access vector to identify an available access object, 
as required by claim 1 . 

For at least these reasons, it is respectfully submitted that the Heath/Schneider 
combination asserted in the Office Action does not render claim 1 unpatentable. 

Independent claims 11,21,31 and 38 also recite for each request, determining 
whether to allow access to a system using an access vector to identify an available access 
object. Accordingly, the asserted Heath/Schneider combination also does not include all 
the Hmitations of independent claims 1 1, 21, 31 and 38, for at least the same reasons. 

Dependent claims 2-10, 12-20, 22-30, 32-37, 39-44 and 45-49 contain by 
reference all the limitations of claims 1, 1 1, 21, 31 and 38, respectively, and hence, are 
not rendered unpatentable by a Heath/Schneider combination for at least the same 
reasons. 

Support for new claims 45-49 is found in the specification at least in Figure 4; 
page 9, line 7, through page 10, line 2; and page 12, lines 13-21. 

In view of the foregoing, Applicant respectfully requests the Examiner to find the 
application in condition for allowance. However, if for any reason the Examiner believes 
that the application is not now in condition for allowance, the Examiner is respectfully 
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requested to call the undersigned to resolve any issues and to expedite the disposition of 
the application. 

Applicant hereby petitions for any extension of time that may be required to 
maintain the pendency of this case, and any required fee for such extension is to be 
charged to Deposit Account No. 05-0460. 



EDELL, SHAPIRO, FINNAN & LYTLE, LLC 
1901 Research Blvd., Suite 400 
Rockville, Maryland 20850-3164 
(301)424-3640 

Hand Delivered on: Januarv 29, 2003 



Respectfully submitted, 




J. Warren Lytle, ^f. 
Registration No. 39,283 
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